A Critical Review of 23andMe’s Bankruptcy: Implications for Personal Genomic Data

Commercializing Direct-to-Consumer Genomics

In 2007, 23andMe launched its direct-to-consumer (DTC) genetic testing service, introducing a novel business model in personal genomics. Customers could purchase a kit, submit a saliva sample, and receive a report outlining ancestry composition, selected traits, and preliminary health insights. This model initially relied on a one-time payment, approximately the price of a modest dinner, with no recurring charges.

The concept gained rapid traction. Public interest in ancestry surged, and the accessibility of genetic information became a cultural phenomenon. By 2012, the term “spit kit” was widely recognized, and 23andMe had positioned itself as a pioneer in the growing field of consumer genomics. Its founders became prominent advocates for the democratization of genetic data and citizen-led scientific participation.

Despite its popularity, 23andMe encountered regulatory challenges. In 2013, the U.S. Food and Drug Administration (FDA) mandated that the company cease offering health-related interpretations until it could demonstrate analytical and clinical validity. The company subsequently suspended these features for two years while undergoing regulatory review.

When health reporting resumed in 2015, the product was restructured. The company introduced tiered pricing, offering basic ancestry services with optional health features at an added cost. This pivot sought to diversify revenue while maintaining compliance. Nevertheless, the one-time payment structure persisted, and the absence of recurring engagement with users remained a significant limitation to long-term revenue.

Market Pressures and the Transition to Public Ownership

As initial user growth plateaued, venture capital backers began seeking liquidity. In 2021, 23andMe completed a merger with VG Acquisition Corp., a special-purpose acquisition company (SPAC), thereby becoming publicly listed under the ticker symbol ME. The transaction valued the company at approximately $3.5 billion.

Going public altered the strategic focus. Quarterly financial disclosures replaced internal reports, and profit maximization for shareholders became a legal obligation. The direct-to-consumer model, with limited opportunities for upselling or customer retention, came under scrutiny. Stakeholders expected consistent revenue growth, prompting leadership to explore new monetization avenues.

To respond to these pressures, 23andMe introduced several initiatives:

  1. Subscription Services. The company launched 23andMe+, a membership program offering extended insights and periodic updates for an annual fee. This model sought to convert static consumers into ongoing subscribers.
  2. Data Licensing Partnerships. Collaborations with pharmaceutical firms, notably GlaxoSmithKline, enabled the monetization of aggregated genomic data for research and drug development.
  3. Consumer Health Products. The company briefly offered genomics-themed skincare and wellness supplements, although these received limited scientific validation and consumer uptake.

While theoretically promising, these efforts yielded mixed results. Subscription adoption plateaued, business-to-business income was uneven, and consumer products did not scale. Meanwhile, the core market for new customers steadily declined, as most early adopters had already been reached.

Data Security Incident and Public Confidence

On October 1, 2023, 23andMe suffered a significant data breach involving a credential-stuffing attack. Malicious actors gained access to user accounts and extracted relationship data from the DNA Relatives and family tree features. Although raw genetic data was not compromised, the incident revealed personal information such as names and genetic relationships.

This breach further eroded public trust and amplified privacy concerns, particularly among customers who had opted into social or research features. The company’s response included free service extensions and public statements, but reputational damage was substantial. Legal actions in multiple jurisdictions soon followed.

On March 23, 2025, 23andMe filed for Chapter 11 bankruptcy protection in the Eastern District of Missouri. Court documents revealed liabilities totaling approximately $1 billion and cash reserves of $50 million, insufficient to sustain operations without restructuring.

On May 19, 2025, it was publicly reported that biotechnology firm Regeneron would acquire 23andMe for approximately $256 million. This acquisition is expected to include 23andMe's intellectual property and customer genetic data, pending regulatory approvals. The move has sparked renewed concern over the fate of users’ personal genomic information, particularly regarding how it will be handled, integrated, or repurposed within Regeneron’s existing pharmaceutical and research infrastructure.

Chapter 11 allows temporary suspension of debt obligations while management seeks reorganization or sale. The company’s genomic database, one of its most valuable assets, became central to this process. Legal debates focused on how and whether this data could be sold, and under what privacy safeguards. Regulators and attorneys general advocated for consumer protections during any asset transfer.

The Enduring Value of Raw Genomic Data

Consumers who submitted DNA samples to 23andMe were granted access to their raw data, specifically single-nucleotide polymorphism (SNP) files. These files, typically around 25 megabytes in size, list hundreds of thousands of loci along with the individual's corresponding genotype.

These raw files are valuable beyond the original reports. Various third-party tools and platforms can be used to analyze them:

  • GEDmatch enables cross-platform matching for genealogy research.
  • DNA Painter maps inheritance patterns across chromosomes.
  • Promethease offers literature-based variant interpretations.
  • Full-Human.Health provides health and wellness reports using genomic input. Our approach emphasizes personal empowerment: everyone should have access to their own genomic data, along with open tools to understand it. We do not store user genomes unless there is clear, informed approval and a compelling reason to do so. The default is privacy-first, with analysis performed client-side or temporarily in secure environments without long-term retention.

Given the irreversible nature of genetic deletion, users are strongly encouraged to download and securely archive their data prior to initiating any account closure.

Responsible Data Management for Former Users

Exiting 23andMe requires careful attention to both data preservation and privacy. The recommended steps are:

  1. Download Raw Data. Navigate to Account Settings and export the raw SNP data. Confirm file integrity and completeness.
  2. Secure Storage. Place the file in encrypted digital storage. Maintain redundancy across separate physical or cloud-based environments.
  3. Sample Discard Request. Under Preferences, submit a formal request for biological sample destruction. Laboratory confirmation may take several weeks.
  4. Optional Account Deletion. Users wishing to disengage entirely may request data erasure. According to the company’s policy, data is removed from active systems within 30 days, though regulatory backups may persist.

Customers affected by the data breach or subscription issues may file claims through the Kroll portal until July 14, 2025. Both digital and mail-in submissions are accepted.

The bankruptcy of 23andMe signals deeper questions about the sustainability of DTC genomics under current business models. Legislative proposals in the U.S. and the EU are considering stricter privacy protections and transparency in algorithmic decision-making. The field may shift toward higher-cost services with stronger consent protocols that require clear, granular, and ongoing user agreement to data collection, usage, and sharing practices, along with frequent re-authorization prompts and enhanced transparency mechanisms, and less reliance on data reselling.

Emerging competitors are exploring alternative approaches:

  • EncrypGen uses decentralized platforms to allow users to license their genomic data selectively.
  • Nebula Genomics emphasizes full genome sequencing and end-to-end encryption.
  • Clinical integrators offer sequencing coupled with in-person genetic counseling.
  • Full-Human.Health promotes data ownership and privacy. Users retain full control of their raw genetic data and can use modern analytical tools without the need to surrender their genome to a central server. Our model centers on individual autonomy, minimal data retention, and informed, opt-in analysis options.

These models seek to balance innovation with individual autonomy and ethical stewardship of sensitive information.

Despite corporate instability, DNA persists as a biological constant. It transcends companies, markets, and technological cycles. A properly stored genome file remains a useful asset, enabling future analysis, health insights, and genealogical discovery.

As commercial genomics matures, consumers and regulators alike will need to demand transparency, privacy, and long-term control over personal data. The fate of 23andMe is both a cautionary tale and a transitional chapter in the evolving relationship between individuals and their biological information.

This article is intended for informational purposes and does not constitute legal or medical advice.